breachcache

Publishing DFIR cases with full kill chains, IOCs, negotiations and real footage of threat actors operating.

[breachcache @breachcache]

New case: World Leaks

Targeted brute force → privacy sexy defense kill → Cobalt Strike → RustyRocket exfil across 6,900 Cloudflare IPs → personalized extortion notes to every employee

Video, negotiation chats, and operator README included.

Case:
https://t.co/8YXTIArhft

[BleepingComputer @BleepinComputer]

Hackers bypass SonicWall VPN MFA due to incomplete patching
https://t.co/EgWyou5AAZ

https://t.co/EgWyou5AAZ

[Ctrl-Alt-Intel @ctrlaltintel]

A little thread exposing screenshots + comms from the Gentlemen Leaks. These provide super interesting insight into the inside operations of successful RaaS groups.

Everything from aspects of operators personal lives, their TTPs, and victims. All images shared are from the Rocket[.Chat leak

We even discovered in March they attempted to send flowers to a UK-based victim....

On 28th Feb, they recognise they're "top 2" on https://t.co/hpPlgsz0wo + Devman has gone ;)🚓

Translation of zeta88's first message:

"In short, Devman was either taken in, for health reasons, or because of a rebranding—it all disappeared.
And we're top 2 on RansomLive based on statistics, but not based on profit, I think."

We can see a @GangExposed tweet shared by The Gentlemen, alongside the https://t.co/hpPlgsz0wo stats

[Ctrl-Alt-Intel @ctrlaltintel]

We are having a great time looking at the Gentlemen Ransomware leaks

[breachcache @breachcache]

The threat actors IP 77.90.185[.]9 was found hosting a well known brute VPN Brute forcing tool called "VPN Brute" hosting a login portal on port 7000.

17 VPN Brute instances were found on Censys with this search:
web.endpoints.http.body_hash_sha256 = "a045f3267dd84d315eb3ffaf4827860b70665269aaeeff86cb1e381c2b7f55c4"

[breachcache @breachcache]

A recent SonicWall SSL VPN brute forcing has been observed.

A total of 24,624 POST attempts to /api/sonicos/auth on port 4433 over 10 hours. Every attempt originated from this one source IP 77.90.185[.]9.

All 24,624 attempts used the single password Spring2026!. The user names consistent of exactly 1000 common US surnames appended with first initial. Username format was <first-initial><surname>.

Sample firewall log entry from the campaign:

id=firewall sn=XXXXXXXXX time="2026-05-13 04:57:11 UTC" fw=x.x.x.x pri=4 c=32 m=745 msg="User login denied - LDAP authentication failure (User: tmiller)" src=77.90.185[.]9 dst=x.x.x.x:4433

IOC:
- 77.90.185[.]9

[breachcache @breachcache]

When a brute force hit lands the SonicWall returns success=true with a bearer-token JWT scoped as API_AUTH_SSLVPN and the firewall logs an m=602 event. The response also exposes the SonicWall model in use.

Firewall success log:

id=firewall sn=XXXXXXXXX time="2026-05-13 04:57:11 UTC" fw=x.x.x.x pri=6 c=32 m=602 msg="WAN zone remote user login allowed" usr="tmiller" src=77.90.185[.]9 dst=x.x.x.x:4433

The token gives the threat actor SSL VPN access to the network which can be further established with tools like NetExtender.

Successful result:

[breachcache @breachcache]

@ctrlaltintel @Sh4dow3x3 Let’s gooo! Amazing work

[Ctrl-Alt-Intel @ctrlaltintel]

Over 7 a month period, a Qilin affiliate exposed 5 C2 servers -&gt; OPSEC L

-&gt; Sliver C2 / SOCKS running on WatchGuard devices
-&gt; Initial access primarily via WG/Fortinet exploitation
-&gt; 3 real victims found via Qilin blog
-&gt; 🇺🇸 &amp; 🇩🇪 targeting
-&gt; 7+ CVEs used

Link to blog below👇

[breachcache @breachcache]

Patch your SonicWalls ASAP and don’t publicly expose your management console!

CVE-2026-0204
CVE-2026-0205
CVE-2026-0206

https://t.co/uty4emjQzn

[Ctrl-Alt-Intel @ctrlaltintel]

When a Qilin affiliate makes many big #oopsies over 7 months... not knowing they are silently being tracked by us🤩

Ctrl-Alt-Intel blog coming later this week🤪

[breachcache @breachcache]

A lot of cyber folks utilize Udemy for self learning. Following the ShinyHunters breach it’s worth checking have i been pwned to see if your data was leaked.

[Have I Been Pwned @haveibeenpwned]

New breach: Udemy had 1.4M email addresses leaked yesterday following an extortion attempt by ShinyHunters. Data included name, address, phone, employer info and instructor payout method. 56% were already in @haveibeenpwned. Read more: https://t.co/qxq9LkoMqs

[Have I Been Pwned @haveibeenpwned]

New breach: Udemy had 1.4M email addresses leaked yesterday following an extortion attempt by ShinyHunters. Data included name, address, phone, employer info and instructor payout method. 56% were already in @haveibeenpwned. Read more: https://t.co/qxq9LkoMqs

[breachcache @breachcache]

@vxunderground GPT-2017-0144

[breachcache @breachcache]

@yacineMTB Threat actors use Windows

[breachcache @breachcache]

@vxunderground Zip bomb

[breachcache @breachcache]

@vxunderground

[breachcache @breachcache]

@0xTib3rius p-i-n-g 8-8-8-8

[breachcache @breachcache]

@minchoi But, but Macs can’t get hacked!

[breachcache @breachcache]

@ZackKorman I vote we go back to pen and paper